NAME

slapd-shell - Shell backend to slapd

SYNOPSIS

/etc/ldap/slapd.conf

DESCRIPTION

The Shell backend to slapd(8) executes external programs to implement
operations, and is designed to make it easy to tie an existing database
to the slapd front-end.
This backend is primarily intended to be used in prototypes.

ACCESSCONTROL

The shell backend does not honor all ACL semantics as described in
slapd.access(5). In general, access to objects is checked by using a
dummy object that contains only the DN, so access rules that rely on
the contents of the object are not honored. In detail:
The add operation does not require write(=w) access to the children
pseudo-attribute of the parent entry.
The bind operation requires auth(=x) access to the entry pseudo-
attribute of the entry whose identity is being assessed; auth(=x)
access to the credentials is not checked, but rather delegated to the
underlying shell script.
The compare operation requires read(=r) access (FIXME: wouldn't
compare(=c) be a more appropriate choice?) to the entry pseudo-
attribute of the object whose value is being asserted; compare(=c)
access to the attribute whose value is being asserted is not checked.
The delete operation does not require write(=w) access to the children
pseudo-attribute of the parent entry.
The modify operation requires write(=w) access to the entry pseudo-
attribute; write(=w) access to the specific attributes that are
modified is not checked.
The modrdn operation does not require write(=w) access to the children
pseudo-attribute of the parent entry, nor to that of the new parent, if
different; write(=w) access to the distinguished values of the naming
attributes is not checked.
The search operation does not require search(=s) access to the entry
pseudo_attribute of the searchBase; search(=s) access to the
attributes and values used in the filter is not checked.

EXAMPLE

There is an example search script in the slapd/back-shell/ directory in
the OpenLDAP source tree.

LIMITATIONS

The shell backend does not support threaded environments. When using
the shell backend, slapd(8) should be built --without-threads.